adjusted traversal path validation (#1533)

aline-pereira · web-flow · commit 1be6f16d4265 · 2026-02-25T13:22:03.000-03:00
diff --git a/utils/http.ts b/utils/http.ts
@@ -133,7 +133,7 @@ function normalizePathParam(
   }
 
   // Step 2: Check for path traversal in decoded value
-  if (decoded.includes("..")) {
+  if (decoded.includes("../") || decoded.includes("..\\")) {
     throw new Error(
       `Path traversal detected in parameter '${paramName}'`,
     );

Original file line number	Diff line number	Diff line change
`@@ -133,7 +133,7 @@ function normalizePathParam(`
`133`	`133`	`}`
`134`	`134`
`135`	`135`	`// Step 2: Check for path traversal in decoded value`
`136`		`- if (decoded.includes("..")) {`
	`136`	`+ if (decoded.includes("../") \|\| decoded.includes("..\\")) {`
`137`	`137`	`throw new Error(`
`138`	`138`	`Path traversal detected in parameter '${paramName}'`,
`139`	`139`	`);`